From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16891C43334 for ; Tue, 5 Jul 2022 13:07:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 725416B0071; Tue, 5 Jul 2022 09:07:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 65FF06B0073; Tue, 5 Jul 2022 09:07:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 502306B0074; Tue, 5 Jul 2022 09:07:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 3C6BA6B0071 for ; Tue, 5 Jul 2022 09:07:44 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 111683485E for ; Tue, 5 Jul 2022 13:07:44 +0000 (UTC) X-FDA: 79653073248.16.F1974C4 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf11.hostedemail.com (Postfix) with ESMTP id A884A40002 for ; Tue, 5 Jul 2022 13:07:42 +0000 (UTC) Received: from dggpemm500024.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4Lcjbm4NylzkX1h; Tue, 5 Jul 2022 21:06:12 +0800 (CST) Received: from dggpemm500013.china.huawei.com (7.185.36.172) by dggpemm500024.china.huawei.com (7.185.36.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Jul 2022 21:07:39 +0800 Received: from [127.0.0.1] (10.67.108.67) by dggpemm500013.china.huawei.com (7.185.36.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 5 Jul 2022 21:07:38 +0800 Message-ID: <155be8eb-0255-342f-bac8-46efb868d97c@huawei.com> Date: Tue, 5 Jul 2022 21:07:38 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.0 From: Chen Zhongjin Subject: Re: [PATCH v5 08/10] ARM: uaccess: add __{get,put}_kernel_nofault Reply-To: <20220201172942.nxop6cjr3xfa4237@maple.lan> To: CC: , , , , , , , , Content-Language: en-US Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [10.67.108.67] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpemm500013.china.huawei.com (7.185.36.172) X-CFilter-Loop: Reflected ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf11.hostedemail.com: domain of chenzhongjin@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=chenzhongjin@huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1657026463; h=from:from:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=4oQaIKlvl2HmVBnSrvBQslCUCK6LkJk2wPp10lWK79A=; b=KAJDbRJgFIaDeqMtzwajKATT3mgcFqbWiVq9eQn1TY9+0BcHNoTXd6RbA8f4Z82FFRnnXQ tNRc/6L3Zjnm7mM7jERj3XvbDa4n7hzipalp1PkXZE//0TqwBWFVssuWKKJIBtS2SsKNmT raQi0qXyfFcK2DaC9qCKAChrjAFUq+A= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1657026463; a=rsa-sha256; cv=none; b=lXZ4G8n89szb8hdCHqTGAOAmXs4FUYxRNNrzsGvQ4MQ7I1qtVXQgZPNLOfpdVQvo1imIM4 rY7Gg/oKf471MU8yYsbGeX7HUkLUx41YKCs0YQwjAepSYJGdwcF2sQIEUxCcwqzWI7CEfV yvQcnFDxGtXgag5HbPNHiasU8dIlTT8= X-Stat-Signature: psgok6c59tu893fpf61715xfctqowu6f X-Rspamd-Queue-Id: A884A40002 Authentication-Results: imf11.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf11.hostedemail.com: domain of chenzhongjin@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=chenzhongjin@huawei.com X-Rspamd-Server: rspam03 X-Rspam-User: X-HE-Tag: 1657026462-283931 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi, It seems that the problem has not been solved so far. I found that "echo t > /proc/sysrq-trigger" causes the same fault because "print_worker_info()" also calls "copy_from_kernel_nofault()", but "worker->current_pwq" can be zero when copying. Stack trace: [   15.303013] 8<--- cut here --- [   15.303315] Unhandled fault: page domain fault (0x01b) at 0x00000004 [   15.303538] [00000004] *pgd=6338f831, *pte=00000000, *ppte=00000000 [   15.304367] Internal error: : 1b [#1] SMP ARM [   15.304721] Modules linked in: [   15.305107] CPU: 0 PID: 89 Comm: sh Not tainted 5.19.0-rc5-dirty #332 [   15.305373] Hardware name: ARM-Versatile Express [   15.305529] PC is at copy_from_kernel_nofault+0xf0/0x174 [   15.305712] LR is at copy_from_kernel_nofault+0x30/0x174 [   15.305873] pc : []    lr : []    psr: 20000013 [   15.306078] sp : eac4dde8  ip : 0000bff4  fp : eac4de74 [   15.306233] r10: 00000007  r9 : 00000000  r8 : c1a09700 [   15.306397] r7 : c1a04cc8  r6 : 00000004  r5 : eac4de18  r4 : 00000004 [   15.306586] r3 : 00000000  r2 : c2440000  r1 : 00000004  r0 : 00000001 [   15.306831] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none [   15.307120] Control: 10c5387d  Table: 633f006a  DAC: 00000051 ... [   15.318121]  copy_from_kernel_nofault from print_worker_info+0xd0/0x15c [   15.318343]  print_worker_info from sched_show_task+0x134/0x180 [   15.318534]  sched_show_task from show_state_filter+0x74/0xa8 [   15.318714]  show_state_filter from sysrq_handle_showstate+0xc/0x14 [   15.318902]  sysrq_handle_showstate from __handle_sysrq+0x88/0x138 [   15.319173]  __handle_sysrq from write_sysrq_trigger+0x4c/0x5c [   15.319356]  write_sysrq_trigger from proc_reg_write+0xa8/0xd0 [   15.319541]  proc_reg_write from vfs_write+0xb4/0x388 [   15.319708]  vfs_write from ksys_write+0x58/0xd0 [   15.319851]  ksys_write from ret_fast_syscall+0x0/0x54 > On Thu, Jan 13, 2022 at 12:14:50PM +0100, Arnd Bergmann wrote: > > On Thu, Jan 13, 2022 at 10:47 AM Daniel Thompson > > wrote: > > > On Wed, Jan 12, 2022 at 06:08:17PM +0000, Russell King (Oracle) > wrote: > > > > > > > The kernel attempted to access an address that is in the userspace > > > > domain (NULL pointer) and took an exception. > > > > > > > > I suppose we should handle a domain fault more gracefully - what > are > > > > the required semantics if the kernel attempts a userspace access > > > > using one of the _nofault() accessors? > > > > > > I think the best answer might well be that, if the arch provides > > > implementations of hooks such as copy_from_kernel_nofault_allowed() > > > then the kernel should never attempt a userspace access using the > > > _nofault() accessors. That means they can do whatever they like! > > > > > > In other words something like the patch below looks like a promising > > > approach. > > > > Right, it seems this is the same as on x86. > > Hmnn... > > Looking a bit deeper into copy_from_kernel_nofault() there is an odd > asymmetry between copy_to_kernel_nofault(). Basically there is > copy_from_kernel_nofault_allowed() but no corresponding > copy_to_kernel_nofault_allowed() which means we cannot defend memory > pokes using a helper function. > > I checked the behaviour of copy_to_kernel_nofault() on arm, arm64, mips, > powerpc, riscv, x86 kernels (which is pretty much everything where I > know how to fire up qemu). All except arm gracefully handle an > attempt to write to userspace (well, NULL actually) with > copy_to_kernel_nofault() so I think there still a few more changes > to fully fix this. > > Looks like we would need a slightly more assertive change, either adding > a copy_to_kernel_nofault_allowed() or modifying the arm dabt handlers to > avoid faults on userspace access. > > Any views on which is better? > I've tested the copy_from_kernel_nofault_allowed() and agree that it's a enough simple and effective solution. There is only one little gap compared to other arch that it returns -ERANGE while actually it should be a -EFAULT (refer to other arches). Anyway if we want to modify the FSR handlers I guess it's also easy because not we do nothing special for Domain Fault now. > > Daniel. > > > > > > From f66a63b504ff582f261a506c54ceab8c0e77a98c Mon Sep 17 00:00:00 > 2001 > > > From: Daniel Thompson > > > Date: Thu, 13 Jan 2022 09:34:45 +0000 > > > Subject: [PATCH] arm: mm: Implement > copy_from_kernel_nofault_allowed() > > > > > > Currently copy_from_kernel_nofault() can actually fault (due to > software > > > PAN) if we attempt userspace access. In any case, the documented > > > behaviour for this function is to return -ERANGE if we attempt an > access > > > outside of kernel space. > > > > > > Implementing copy_from_kernel_nofault_allowed() solves both these > > > problems. > > > > > > Signed-off-by: Daniel Thompson > > > > Reviewed-by: Arnd Bergmann Tested-by: Chen Zhongjin Best, Chen